Actively exploited in the wild
QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
QNAP - QNAP Network-Attached Storage (NAS) · Listed in the CISA KEV since 2022-04-11. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-2509
CriticalCVSS 9.8KEVSummary
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application.
Risk Assessment
An attacker can take control of the NAS device by executing arbitrary system commands, potentially leading to data theft, malware installation, or using the device as an entry point into the internal network.
Recommendation
Update QTS to version 4.5.2.1566 Build 20210202 or later (or the appropriate earlier branch indicated by the vendor) and QuTS hero to h4.5.1.1491 build 20201119 or later. Limit exposure of NAS administrative interfaces to the Internet.
Other vulnerabilities in QNAP QTS / QuTS hero
See all- CVE-2025-57705Medium
An allocation of resources without limits or throttling vulnerability in QNAP operating systems can be exploited by a remote attacker who gains an administrator account to prevent other systems, applications, or processes from accessing the same type of resource. The vendor has fixed the vulnerability in QTS 5.2.7.3256 build 20250913 and later, and QuTS hero h5.2.7.3256 build 20250913 and h5.3.1.3250 build 20250912 and later.
- CVE-2025-53596Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-53593Medium
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to modify memory or crash processes.
- CVE-2025-53592Medium
A NULL pointer dereference vulnerability affects several QNAP operating system versions. A remote attacker who gains a user account can exploit it to launch a denial-of-service (DoS) attack.
- CVE-2025-53591Medium
A use of externally-controlled format string vulnerability affects several QNAP operating system versions. A remote attacker who gains an administrator account can exploit it to obtain secret data or modify memory.
- CVE-2025-53589Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-53414Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-53405Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-52431Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-47208Medium
An allocation of resources without limits or throttling vulnerability affects several QNAP operating system versions. A remote attacker who gains a user account can exploit it to prevent other systems, applications, or processes from accessing the same type of resource.
Original NVD description (English source)
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS